Privacy Policy
Verispec AI Ltd ("VeriSpec", "we", "us") operates verispec.ai, an AI-assisted service for reviewing engineering specifications and drawings. This policy explains what personal information we handle, why we handle it, and how to contact us about your rights.
Privacy and deletion requests: email hello@verispec.ai. You do not need a VeriSpec account to make a request.
1. Who is responsible for your information
Our registered address is 6 Marine Drive, Brampton, ON L6R 2H6, Canada. We determine how account administration, billing, website enquiries and security information are used. For personal information contained in a customer's uploaded documents and associated results, we generally act on that customer's instructions. Any applicable customer data-processing agreement also governs that processing.
If your information appears in a customer's documents, you may contact that customer or contact us. We will help route the request to the responsible customer and assist with its handling.
2. Information we collect
- Accounts and organisations: names, email addresses, user and organisation identifiers, roles and invitation details. Clerk provides authentication; we do not receive your password.
- Demo enquiries and correspondence: work email, optional referral information, the source of an enquiry, browser information, submission time and information you provide in correspondence or a calendar booking. Our demo form requests a work email. If a personal-email address is refused, we still record the submitted address, domain, source and time for enquiry follow-up and refusal analysis.
- Customer content: uploaded specifications and drawings, extracted text, page images, AI requests and responses, findings, reports and annotations. Documents may contain names, signatures, professional registration numbers and contact information.
- Engineer reviews: confirmations, rejections, edits, reasons, reviewer identity and time, together with the relevant rule text and document excerpts.
- Billing: organisation-level credit purchases, usage and related business records. Our application ledger does not store payment-card details.
- Security and operations: significant account actions, actor and organisation identifiers, timestamps, IP addresses, browser details and outcomes; application logs, error reports and model-call metadata.
- Website technologies: browser and network information received by website providers, advertising events and browser storage described in our Cookie Notice.
Information comes from you, your organisation's administrators and users, authentication and service providers, and your use of the website. The service is intended for business use, not children. Do not upload sensitive personal information unrelated to an engineering review, such as health records or biometric data.
3. How and why we use information
We use information to provide accounts and document reviews, respond to enquiries, deliver support, administer billing, maintain security, investigate faults and misuse, address requests and comply with applicable legal obligations. Engineer reviews help us evaluate accuracy, improve model instructions and select models. Reviewed rows can contain customer document excerpts; they are not automatically anonymous.
Where the GDPR or UK GDPR applies, our basis depends on the purpose: performing a contract with you or taking requested pre-contract steps; legitimate interests in administering business customer relationships, securing and maintaining the service and responding to enquiries; legal obligations; and consent where required. A contract with an employer is not automatically a contract with its employee. Customer-controlled document processing follows the customer's instructions and applicable agreement. We balance legitimate interests against individuals' rights, including objections.
Information needed for account access or a requested service is necessary to provide it. Optional enquiry information is voluntary. Demo enquiries are used to arrange and follow up on the demo, rather than enrol you in a newsletter.
4. AI processing and human review
Document analysis sends specification text, drawing images and image crops to third-party AI model hosts through OpenRouter. Customer documents use the OpenRouter route, with requests restricted to hosts offering zero data retention and no collection of request data, and to a reviewed list of models. Direct provider routes are not permitted for customer documents.
Those routing restrictions depend on OpenRouter and the model host to enforce them. They do not mean that VeriSpec retains no data: we store run content and results as explained below. We use third-party models as supplied and have no model-training pipeline of our own. Engineer feedback is used for evaluation and service improvement.
AI findings can be wrong or incomplete. VeriSpec supports qualified human engineering review; it does not certify a design or replace professional judgement. We do not use the service to make solely automated decisions about individuals with legal or similarly significant effects.
5. Sharing and international processing
We use hosting, storage, authentication, AI, monitoring, email and calendar providers. Our Service Providers page explains their roles. Within an organisation, authorised users can access the organisation's shared runs and related activity; admins have additional access, including audit records.
We do not sell personal information for money or use customer document content for advertising. Advertising providers receive website information and conversion events; some laws may classify such disclosure as advertising "sharing" or a "sale" even without a monetary payment. Contact us about applicable objection or opt-out rights.
We may disclose information when legally required, to investigate misuse or protect rights and safety, to professional advisers where necessary, or in a business transaction subject to applicable confidentiality and legal requirements.
We are based in Canada. Our application servers, database, document storage and server logs are in Microsoft Azure's Canada Central region (Toronto). Other providers, including Cloudflare's distributed network for the website and request proxying, operate in the United States and other countries, and model processing locations depend on eligible hosts. Foreign authorities may have lawful access under local law. Contact us for information about relevant processing locations and applicable contractual transfer arrangements. We do not represent that VeriSpec is certified under the EU–US Data Privacy Framework.
6. Retention and deletion
| Information | Current retention approach |
|---|---|
| Run documents and outputs | 365 days by default, configurable by an organisation admin between 30 and 365 days. The period runs from completion, compile completion where applicable, or creation. The worker checks for expired runs hourly while operating. Queued or active runs are excluded until eligible. Earlier deletion is available through support or the API. Deleted files remain recoverable by us for 7 days, are not used or shown in the product during that time, and are then permanently removed. |
| Reviewed rules and findings | Kept after ordinary run deletion unless the organisation opts out or requests full deletion. These include document excerpts. There is currently no separate automatic maximum retention period for retained reviews; they can be removed by a later full-deletion request. |
| Demo enquiries and refused submissions | Deleted from the application database after 365 days. Email and calendar copies are handled separately. |
| Account, audit and billing records | Account information is used while access is maintained. Deleting an account at Clerk currently leaves its email and user ID in our database. Audit and billing records and content-free run records are not automatically deleted by run deletion. We assess requests separately, including applicable security, accounting and legal retention needs. |
| Logs, traces, backups and correspondence | Separate provider settings and operational or legal needs apply; there is no single run-retention deadline that deletes every copy. Contact us for information about a specific record or deletion request. |
We assess continued retention against the purpose, applicable obligations and requests. Some categories currently lack an automated expiry. A technical limitation is not itself a legal exception to deletion. Where information must be retained, we explain the applicable reason and period or criteria. Deleting a run does not immediately remove backup copies: database backups are kept for 14 days.
7. Your rights and how to make a request
Depending on applicable law and the circumstances, you may request access and a copy, correction, deletion, restriction of processing, portability, or object to processing. Where processing relies on consent, you may withdraw it without affecting the lawfulness of earlier processing. You may also complain to the relevant privacy authority, including the Office of the Privacy Commissioner of Canada, the UK Information Commissioner's Office or an applicable EEA supervisory authority.
Email hello@verispec.ai to request deletion, or use the same address for another privacy request. Tell us the account or organisation concerned and what you would like us to do. No special wording is required. For deletion of an entire run, include retained engineer reviews and document excerpts in the request; you may simply ask for full deletion without knowing our system names.
Do not send passwords, identification documents or confidential drawings with your initial email. We may ask for proportionate information to verify identity or an authorised representative's authority. We will assess the request, coordinate with the customer where appropriate, and explain the outcome and any lawful exceptions. Requests are normally free, subject to exceptions permitted by law.
We respond within applicable legal time limits: ordinarily 30 calendar days for an access request under PIPEDA, or one month where EU GDPR applies, subject to permitted extensions and required notices. Other requests and jurisdictions may have different rules. We will not retaliate against someone for exercising a privacy right.
8. Security and stakeholder concerns
Our safeguards include authenticated access, organisation access controls, private document storage, encrypted connections, audit records and filtering of sensitive content from current error reports and model traces. No system is perfectly secure. We handle incidents and required notifications under applicable law and customer agreements.
Customers, affected individuals and other stakeholders can report privacy, accuracy, fairness or safety concerns to hello@verispec.ai. The responsible team reviews the concern and considers appropriate corrective action, including changes to models, validation, safeguards or instructions. Product review controls also allow engineers to challenge findings.
Customers are responsible for authorised uploads and qualified review of outputs. VeriSpec is responsible for its own data-handling obligations, assisting with applicable customer instructions and responding to competent regulators. Our intended use includes human oversight to reduce foreseeable engineering harm and attention to systematic errors and unintended bias. This policy does not claim ISO certification, a SOC 2 report, HIPAA compliance or PCI DSS compliance.
9. Changes and contact
We update this policy when our practices or applicable requirements change, revise the date above and record changes in our Policy History. We provide additional notice or seek consent where required for a material change.
Verispec AI Ltd
6 Marine Drive
Brampton, ON L6R 2H6
Canada
hello@verispec.ai